diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-04-09 23:05:15 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-04-09 23:12:44 +0200 |
| commit | 2773ab36cc6480ce77845df0b1d1e2f790c59cde (patch) | |
| tree | 03cc018fc608479edb538f9786f6f5b139f74f83 /libavcodec/jpeglsdec.c | |
| parent | 020600eed13fadde334fa26cfeebdc6809eaf1f9 (diff) | |
| download | ffmpeg-2773ab36cc6480ce77845df0b1d1e2f790c59cde.tar.gz | |
avcodec/jpeglsdec/ff_jpegls_decode_lse: check len field validity
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/jpeglsdec.c')
| -rw-r--r-- | libavcodec/jpeglsdec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c index 13b6e41d2a..d8e2bdbac0 100644 --- a/libavcodec/jpeglsdec.c +++ b/libavcodec/jpeglsdec.c @@ -52,11 +52,14 @@ int ff_jpegls_decode_lse(MJpegDecodeContext *s) int id; int tid, wt, maxtab, i, j; - int len = get_bits(&s->gb, 16); /* length: FIXME: verify field validity */ + int len = get_bits(&s->gb, 16); id = get_bits(&s->gb, 8); switch (id) { case 1: + if (len < 13) + return AVERROR_INVALIDDATA; + s->maxval = get_bits(&s->gb, 16); s->t1 = get_bits(&s->gb, 16); s->t2 = get_bits(&s->gb, 16); |